Abnormal Flow Detection Technology in GPU Network Based on Statistical Classification Method
Domain Name System (DNS), as the Internet “hub system” of basic resources services, mainly provides the basic services of domain name and IP address mapping. Abnormal flow detection technology plays an important role in the security service quality of Internet basic services, and it is also one of the important contents of Internet security research. The existing research mainly focuses on the analysis of network flow and other technologies at the data level, but in the context of network attacks, especially in the case of DDoS attacks, the accuracy and detection performance need to be improved. Based on the statistical method of high-performance abnormal flow detection technology, in this paper, the flow data are used for real-time statistical fitting, and the difference is made with the historical log data statistics. GPU parallel technology is used to improve the detection performance, which improves the accuracy and detection performance in the case of DDoS attacks on the network.
KeywordsAbnormal flow detection Network flow GPU
This work was partly supported by the National Key R&D Program of China (No. 2017YFB0203102), the State Key Program of National Natural Science Foundation of China (No. 91530324).
- 1.Verisign. The domain name industry brief [EB/OL]. https://www.verisign.com/assets/domain-name-report-Q42017.pdf
- 2.CNNIC. The forty-first statistical report on China’s Internet development [EB/OL]. http://www.cnnic.cn/hlwfzyj/hlwxzbg/hlwtjbg/201803/P020180305409870339136.pdf
- 3.Krishnamurthy, B., Sen, S., Zhang, Y.: Sketch-based change detection: methods, evaluation and applications. In: Proceedings of the 3th ACM SIGCOMM Conference on Internet Measurement (2003)Google Scholar
- 7.Dewaele, G., Fukuda, K., Borgnat, P., Abry, P., Cho, K.: Extracting hidden anomalies using sketch and non Gaussian multiresolution statistical detection procedures. In: Workshop on Large Scale Attack Defense (2007)Google Scholar
- 8.Mikle, O.: Detecting Hidden Anomalies in DNS Communication [EB/OL]. https://www.dns-oarc.net/files/workshop-201210/DNS-anomaly-OF.pdf
- 9.Luo, N.: Research and implementation of abnormal flow monitoring method based on synopsis data structure (2008)Google Scholar
- 10.Xie, K., Wang, L., Wang, X., Xie, G., Wen, J., Zhang, G.: Accurate recovery of internet flow data: a tensor completion approach. In: INFOCOM (2016)Google Scholar